Location Privacy-preserving Mechanisms Research Articles

Quantifying Location Privacy for Navigation Services in Sustainable Vehicular Networks

Current connected and autonomous vehicles will contribute to various and green vehicular services. However, sharing personal data with untrustworthy Navigation Service Providers (NSPs) raises serious location concerns. To address this issue, many Location Privacy-Preserving Mechanisms (LPPMs) have been proposed. In addition, several quantification methods have been designed to help understand location privacy and illustrate how location privacy is leaked. However, their assessment is insufficient due to the incomplete assumptions about the adversary’s model. In particular, users tend to request the same navigation routes from <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">home</i> to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">workplace</i> and acquire traffic information along the route. An adversary can collect the coordinates of adjacent locations and infer the two true locations. In this paper, we provide a formal framework for the analysis of LPPMs in navigation services. Our framework captures extra information that is available to an adversary performing localization attacks. By formalizing the adversary’s performance, we also propose and justify two new metrics to quantify location privacy in navigation services, namely <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">accuracy</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">visibility</i> . We assess the efficacy of two popular LPPMs for location privacy, i.e., differential privacy and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${k}$ </tex-math></inline-formula> -anonymity. Experimental results demonstrate that the adversary can recover users’ locations with a high probability.

Protecting Location Privacy of Users Based on Trajectory Obfuscation in Mobile Crowdsensing

In mobile crowdsensing activities, it is usually necessary for participants to upload sensing data and related locations. The existing location privacy-preserving mechanisms cannot well protect a user's trajectory privacy because attackers can mine the user's trajectory features through data analysis techniques. Aiming at the trajectory privacy protection problem, this article proposes a differential location privacy-preserving mechanism based on trajectory obfuscation (LPMT). LPMT first extracts the stay points as the features of a trajectory based on the sliding window algorithm, and then obfuscates each stay point to a target obfuscation subregion through the exponential mechanism, and finally performs the Laplace sampling in the target obfuscation subregion to obtain the obfuscated GPS points. Compared with the baseline mechanisms, LPMT can reduce data quality loss by more than 20% while providing the same level of obfuscation quality, which indicates that LPMT has the advantages of strong security and high quality of service.

Guest Editorial: Special Section on Distributed Intelligence Over Internet of Things

N OWADAYS, billions of devices are connected to the In-ternet, enabling Internet of Things (IoT) systems widely deployed, such as smart city, smart healthcare and intelligent plant, to capture a great quantity of sensing data. Consequently, the data transmission, processing and analysis in IoT applications bring a great pressure to the central server. Fortunately, distributed intelligence becomes one of the potential solutions. Distributed intelligence can greatly relieve server pressures via plenty of terminal devices, and these devices collaboratively perceive and handle the mass data to improve the reliability, s-calability and security of industrial IoT systems. As future IoT system will embrace more wireless sensors and devices, the high-performance computing, high-bandwidth and low-latency communication are excessively required, many new research opportunities and challenges for distributed intelligence over Internet of things have arisen. To promote the development of distributed intelligence technology, this special section (SS) focuses on various technologies and platforms regarding industrial IoT systems. This special section received nearly 50 submitted manuscripts, out of which 10 of them have been accepted after a rigorous peer review. Each manuscript is reviewed by multiple rounds of review with at least three or four reviewers, the problems to be solved and the innovation of each manuscript are mainly concerned. Then the accepted papers are summarized as follows in details. Considering the joint optimization of the offloading decision and resource allocation under limited resource constraints in collaborative edge computing networks with multiple IIoT devices and MEC servers, an improved differential evolution algorithm [7] is proposed to minimize the weighted sum of cost of energy consumption and time delay, which can effectively reduce the system delay and energy consumption. In order to improve the performance of task scheduling in cloud computing, Attiya et al. [1] propose a novel hybrid swarm intelligence method MRFOSSA, which uses a modified Manta-Ray Foraging Optimizer (MRFO) and the Salp Swarm Algorithm (SSA). MRFOSSA is superior to other methods in terms of makespan time and cloud throughput. The research goal of the paper [5] is to design an intelligent computing offloading strategy for industrial applications in order to optimize costs and mitigate energy losses. Then the paper proposes to combine a fog controller and AI-based learning techniques so that the fog controller can intelligently assign tasks to the most appropriate fog devices and find the appropriate path to the target. Considering the resource utilization efficiency under dynamic overload requests and network states in IIoT, Chen et al. [2] propose DRL-based intelligent SFC orchestration scheme and jointly optimize the VNF deployment and SFC embedment by the improved DDQN algorithm, which can improve the performance of resource utilization rate, execution cost and delay compared with other representative schemes. To solve the problem of resource allocation and energy cost in Internet of Vehicles, Kong et al. [8] design a joint computing and caching framework and formulate the problem as a reinforcement learning problem to minimize the energy cost. On this basis, the optimization algorithm based on DDPG is proposed, which can effectively decrease energy costs. To reduce the query numbers of the object model when constructing adversarial examples, Zhang et al. [10] propose generating adversarial examples with shadow model (GASM), i.e., transfering the query operations to the designed shadow model, which can achieve high attack success rates. Chen et al. [3] revise a Decentralized-Wireless-Federated-Learning algorithm (DWFL) which utilizes the superposition property of the analog scheme. It can solve the problem of single failure, limited bandwidth resource and privacy protection in wireless federated learning algorithm, which can be applied widely in wireless IoT networks. To reduce the resource consumption in CNN-based applications, Jia et al. [6] propose the CNN-based Resource Optimization APProach which utilizes model compression and computation sharing to optimize inner-model and inter-model respectively, and the comparison results show the superior performance in scalability and the decrease of resource cost. In mobile crowdsensing activities, Gao et al. [4] propose a differential Location Privacy-preserving Mechanism based on Trajectory obfuscation (LPMT) to protect the location privacy of mobile users, which includes three operations: stay points extraction, stay points obfuscation and stay points sampling. In order to mimic the task-free bottom-up visual attention process by predicting salient regions on natural images, Umer et al. [9] propose a Pseudo Knowledge Distillation (PKD) model based on knowledge distillation and pseudo labelling technique, which is computationally efficient and suitable for real-time on-device saliency prediction.

Bilateral Privacy-Preserving Truthful Incentive for Mobile Crowdsensing

Reverse auction-based incentive mechanisms have been widely adopted to stimulate mobile workers to participate in mobile crowdsensing (MCS), where workers need to provide location information for winner selection. However, most existing mechanisms rely on trusted platforms. The worker’s location data uploaded to platforms thus can be easily exposed. Recent works start to incorporate location privacy in designing incentive mechanisms, but they have not considered the task’s location privacy and the worker’s location privacy simultaneously. Therefore, we propose a bilateral location privacy-preserving mechanism for MCS on untrusted platforms. In our model, each worker adopts differential privacy to obfuscate his location locally and then submits the obfuscated location together with the bid information. Besides, instead of the exact location, the task requester is only required to upload the task profile and the task’s obfuscated location. Then, we propose the lowest-cost winner selection mechanism which aims to minimize the social cost of winner selection under the location constraint while ensuring task quality requirements, and adopt the critical payment determination mechanism to determine the payments for the winners, which satisfies truthfulness, individual rationality, and computational efficiency. Theoretical analysis and extensive experiments on real-world datasets show the effectiveness of the proposed mechanisms.

A process calculus for privacy-preserving protocols in location-based service systems

Location privacy-preserving mechanisms (LPPM) were introduced to protect users of location-based services (LBS) from the privacy threat of leaked personal data. These mechanisms alter the communication to the LBS in such a way that no malicious party can derive sensitive personal data. In the literature one can find many different LPPMs with varying privacy guarantees but so far no formal framework exists for comparing all of these mechanisms and their privacy guarantees. We propose the σ-calculus, which enables the modeling of LPPMs and location privacy guarantees. The calculus entails a process language, a property language, and a temporal-K-less-epistemic modal logic that enables the verification of location privacy properties on process models. The σ-calculus is a novel process calculus that is based on standard set operations that are computationally cheap, yet sufficient for modeling privacy violations in LBS communication. The calculus is the first formal framework to model and reason about a wide array of LPPMs. Furthermore, we present model checking algorithms that enable the automatic verification of location privacy properties. We evaluate the expressiveness of our process language by modeling a significant number of LPPMs from the literature and the expressiveness of our property language by describing a benchmark set of location privacy properties. Furthermore, we demonstrate the verification of a privacy property with an extended example of an LPPM algorithm designer. We developed the tool LP3Verif that implements our model checking algorithms. The open-source tool is written in Java and uses the SMT solver CVC4 as back end.

Protecting Spatiotemporal Event Privacy in Continuous Location-Based Services

Location privacy-preserving mechanisms (LPPMs) have been extensively studied for protecting users' location privacy by releasing a perturbed location to third parties such as location-based service providers. However, when a user's perturbed locations are released continuously, existing LPPMs may not protect the sensitive information about the user's real-world activities, such as “visited hospital in the last week” or “regularly commuting between location A and location B every weekday” (it is easy to infer that location A and location B may be home and office), which we call it spatiotemporal event. In this paper, we first formally define spatiotemporal event as Boolean expressions between location and time predicates, and then we define ε-spatiotemporal event privacy by extending the notion of differential privacy. Second, to understand how much spatiotemporal event privacy that existing LPPMs can provide, we design computationally efficient algorithms to quantify the spatiotemporal event privacy leakage of state-of-the-art LPPMs. It turns out that the existing LPPMs may not adequately protect spatiotemporal event privacy. Third, we propose a framework, PriSTE, to transform an existing LPPM into one protecting spatiotemporal event privacy by calibrating the LPPM's privacy budgets. Our experiments on real-life and synthetic data verified that the proposed method is effective and efficient.

A Framework for Personalized Location Privacy

Location privacy has been one of the most important research areas over recent years, and many location Privacy Preserving Mechanisms (PPMs) have been proposed. Each PPM typically achieves certain tradeoffs between privacy protection and resource consumption, and no PPM performs perfectly in all cases. Instead of designing one PPM that works for all cases, this paper studies how to make the best use of multiple single PPMs for location privacy protection in different scenarios. In particular, we propose a general framework called SmartGuard, which dynamically selects the best privacy preservation strategy for a user based on her preferences and the current status of her mobile device. SmartGuard quantifies user privacy under various scenarios, models the effects of different PPMs on several key factors such as the remaining battery level and network bandwidth, and then recommends the best privacy strategy for the user. To illustrate how our SmartGuard works, we apply it to a specific scenario of LBSs and implement it on Android based phones. Evaluation results show that our solution outperforms existing PPMs under various scenarios.

Location Privacy-preserving Mechanisms in Location-based Services

Location-based services (LBSs) provide enhanced functionality and convenience of ubiquitous computing, but they open up new vulnerabilities that can be utilized to violate the users’ privacy. The leakage of private location data in the LBS context has drawn significant attention from academics and industry due to its importance, leading to numerous research efforts aiming to confront the related challenges. However, to the best of our knowledge, none of relevant studies have performed a qualitative and quantitative comparison and analysis of the complex topic of designing countermeasures and discussed the viability of their use with different kinds of services and the potential elements that could be deployed to meet new challenges. Accordingly, the purpose of this survey is to examine the privacy-preserving techniques in LBSs. We categorize and provide an inside-out review of the existing techniques. Performing a retrospective analysis of several typical studies in each category, we summarize their basic principles and recent advances. Additionally, we highlight the use of privacy-preserving techniques in LBSs for enabling new research opportunities. Providing an up-to-date and comprehensive overview of existing studies, this survey may further stimulate new research efforts into this promising field.

Privacy-Enhancing Preferential LBS Query for Mobile Social Network Users

While social networking sites gain massive popularity for their friendship networks, user privacy issues arise due to the incorporation of location-based services (LBS) into the system. Preferential LBS takes a user’s social profile along with their location to generate personalized recommender systems. With the availability of the user’s profile and location history, we often reveal sensitive information to unwanted parties. Hence, providing location privacy to such preferential LBS requests has become crucial. However, the current technologies focus on anonymizing the location through granularity generalization. Such systems, although provides the required privacy, come at the cost of losing accurate recommendations. Hence, in this paper, we propose a novel location privacy-preserving mechanism that provides location privacy through k-anonymity and provides the most accurate results. Experimental results that focus on mobile users and context-aware LBS requests prove that the proposed method performs superior to the existing methods.

Leveraging Prior Knowledge Asymmetries in the Design of Location Privacy-Preserving Mechanisms

The prevalence of mobile devices and Location-Based Services (LBS) necessitates the study of Location Privacy-Preserving Mechanisms (LPPM). However, LPPMs reduce the utility of LBSes due to the noise they add to users’ locations. Here, we consider the remapping technique, which presumes the adversary has a perfect statistical model for the user location. We consider this assumption and show that under practical assumptions on the adversary’s knowledge, the remapping technique leaks privacy not only about the true location data, but also about the statistical model. Finally, we introduce a novel method termed Randomized Remapping to provide a trade-off between leakage of the users’ location and leakage of the users’ model for a given utility.

Impact of Frequency of Location Reports on the Privacy Level of Geo-indistinguishability

Abstract Location privacy has became an emerging topic due to the pervasiveness of Location-Based Services (LBSs). When sharing location, a certain degree of privacy can be achieved through the use of Location Privacy-Preserving Mechanisms (LPPMs), in where an obfuscated version of the exact user location is reported instead. However, even obfuscated location reports disclose information which poses a risk to privacy. Based on the formal notion of differential privacy, Geo-indistinguishability has been proposed to design LPPMs that limit the amount of information that is disclosed to a potential adversary observing the reports. While promising, this notion considers reports to be independent from each other, thus discarding the potential threat that arises from exploring the correlation between reports. This assumption might hold for the sporadic release of data, however, there is still no formal nor quantitative boundary between sporadic and continuous reports and thus we argue that the consideration of independence is valid depending on the frequency of reports made by the user. This work intends to fill this research gap through a quantitative evaluation of the impact on the privacy level of Geo-indistinguishability under different frequency of reports. Towards this end, state-of-the-art localization attacks and a tracking attack are implemented against a Geo-indistinguishable LPPM under several values of privacy budget and the privacy level is measured along different frequencies of updates using real mobility data.

Anonymization and De-Anonymization of Mobility Trajectories: Dissecting the Gaps Between Theory and Practice

Human mobility trajectories are increasingly collected by ISPs to assist academic research and commercial applications. Meanwhile, there is a growing concern that individual trajectories can be de-anonymized when the data is shared, using information from external sources (e.g., online social networks). To understand this risk, prior works either estimate the theoretical privacy bound or simulate de-anonymization attacks on synthetically created datasets. However, it is not clear how well the theoretical estimations are preserved in practice. In this article, we collected a large-scale ground-truth trajectory dataset from 2,161,500 users of a cellular network, and two matched external trajectory datasets from a large social network (56,683 users) and a check-in/review service (45,790 users) on the same user population. The two sets of large ground-truth data provide a rare opportunity to extensively evaluate a variety of de-anonymization algorithms (nine in total). We find that their performance in the real-world dataset is far from the theoretical bound. Further analysis shows that most algorithms have under-estimated the impact of spatio-temporal mismatches between the data from different sources, and the high sparsity of user generated data also contributes to the under-performance. Based on these insights, we propose four new algorithms that are specially designed to tolerate spatial or temporal mismatches (or both) and model location contexts and time contexts. Extensive evaluations show that our algorithms achieve more than 17 percent performance gain over the best existing algorithms, confirming our insights. Further, we propose two new location-privacy preserving mechanisms utilizing the spatio-temporal mismatches to better protect users' privacy against the de-anonymization attack. Evaluation results show that our proposed mechanisms can reduce the performance of de-anonymization attacks by over 8.0 percent, demonstrating the effectiveness of our insights.

PriSTE

Location privacy-preserving mechanisms (LPPMs) have been extensively studied for protecting a user's location in location-based services. However, when user's perturbed locations are released continuously, existing LPPMs may not protect users' sensitive spatiotemporal event , such as "visited hospital in the last week" or "regularly commuting between location 1 and location 2 every morning and afternoon" (it is easy to infer that locations 1 and 2 may be home and office). In this demonstration, we demonstrate PriSTE for protecting spatiotemporal event privacy in continuous location release. First, to raise users' awareness of such a new privacy goal, we design an interactive tool to demonstrate how accurate an adversary could infer a secret spatiotemporal event from a sequence of locations or even LPPM-protected locations. The attendees can find that some spatiotemporal events are quite risky and even these state-of-the-art LPPMs do not always protect spatiotemporal event privacy. Second, we demonstrate how a user can use PriSTE to automatically or manually convert an LPPM for location privacy into one protecting spatiotemporal event privacy in continuous location-based services. Finally, we visualize the trade-off between privacy and utility so that users can choose appropriate privacy parameters in different application scenarios.

Location Privacy Protection Systems in Presence of Service Quality and Energy Constraints

The wide-ranging application of location-based services (LBSs) through the use of mobile devices and wireless networks has brought about many critical privacy challenges. To preserve the location privacy of users, most existing location privacy-preserving mechanisms (LPPMs) modify their real locations associated with different pseudonyms, which come at a cost either in terms of resource consumption or quality of service, or both. However, we observed that the effect of resource consumption has not been discussed in existing studies. In this paper, we present the user-centric LPPMs against location inference attacks under the consideration of both service quality and energy constraints. Moreover, we modeled the precision-based and dummy-based mechanisms in the context of an existing LPPM framework, and also extended the linear program solutions applicable to them. This study allowed us to specify the LPPMs that decreased the precision of exposed locations or generated dummy locations of the users. Based on this, we evaluated the privacy protection effects of optimal location obfuscation function against an adversary's inference attack function using real mobility datasets. The results indicate that dummy-based mechanisms provide better achievable location privacy under a given combination of service quality and energy constraints, and once a certain level of privacy is reached, both the precision-based and dummy-based mechanisms only perturb the exposed locations. The evaluation results also contribute to a better understanding for the LPPM design strategies and evaluation mechanism as far as the system resource utilization and service quality requirements are concerned.

A Survey on Location Privacy-Preserving Mechanisms in Mobile Crowdsourcing

Mobile Crowdsourcing (MCS) surfaced as a new affluent method for data collection and processing as a result of the boom of sensor-rich mobile devices popularity. MCS still has room for improvement, particularly in protecting workers’ private information such as location. Therefore, the installation of privacy-preserving mechanisms that insulate sensitive infor-mation and prevent attackers from obtaining information is a necessity. In this paper, we discuss location privacy threats and analyze some recently proposed mechanisms that targeted location privacy in mobile crowdsourcing. Finally, we compare and evaluate these mechanisms according to specific criteria that we define in this paper.

The Long Road to Computational Location Privacy: A Survey

The widespread adoption of continuously connected smartphones and tablets developed the usage of mobile applications, among which many use location to provide geolocated services. These services provide new prospects for users: getting directions to work in the morning, leaving a check-in at a restaurant at noon and checking next day's weather in the evening are possible right from any mobile device embedding a GPS chip. In these location-based applications, the user's location is sent to a server, which uses them to provide contextual and personalised answers. However, nothing prevents the latter from gathering, analysing and possibly sharing the collected information, which opens the door to many privacy threats. Indeed, mobility data can reveal sensitive information about users, among which one's home, work place or even religious and political preferences. For this reason, many privacy-preserving mechanisms have been proposed these last years to enhance location privacy while using geolocated services. This article surveys and organises contributions in this area from classical building blocks to the most recent developments of privacy threats and location privacy-preserving mechanisms. We divide the protection mechanisms between online and offline use cases, and organise them into six categories depending on the nature of their algorithm. Moreover, this article surveys the evaluation metrics used to assess protection mechanisms in terms of privacy, utility and performance. Finally, open challenges and new directions to address the problem of computational location privacy are pointed out and discussed.

K-Trustee: Location injection attack-resilient anonymization for location privacy

Cloaking-based location privacy preserving mechanisms have been widely proposed to protect users’ location privacy when using location-based services. A fundamental limitation of such mechanisms is that users and their location information in the system are inherently trusted by the Anonymization Server without any verification. In this paper, we show that such an issue could lead to a new class of attacks called location injection attacks which can successfully violate users’ in-distinguishability among a set of users. We propose and characterize location injection attacks by presenting a set of attack models and quantifying the costs associated with them. We present and evaluate k-Trustee, a trust-aware location cloaking mechanism that is resilient to location injection attacks and guarantees a lower bound on the user’s in-distinguishability. k-Trustee guarantees that each user in a given cloaked region can achieve the required k-Anonymity by including at least k-1 other trusted users in the cloaked region. We demonstrate the effectiveness of k-Trustee through extensive experiments in a real-world geographic map and our experimental results show that the proposed cloaking algorithm guaranteeing k-Trustee is effective against various location injection attacks.

Near-Complete Privacy Protection: Cognitive Optimal Strategy in Location-Based Services

While enjoying the amenities and convenience provided by the location-based service (LBS) in our daily life, wireless device users may surrender their location together with social activity privacy to the LBS provider. The untrusted LBS server has all the information about users in the LBS and it may track them in various ways or release their privacy data to third parties. To address the privacy protection issue, many location obfuscation algorithms behind a location-privacy preserving mechanisms (LPPMs) were proposed but only approached the trade-off between utility and privacy. Unlike the existing approaches, we propose the first methodology and application, to the best of our knowledge, that enables a near-complete location privacy protection for LBS users to achieve an cognitive optimal resolution by employing the social network associated with the LBS to separate the utility and privacy. Evaluation of both simulation and practical smartphone application shows that the proposed methodology could achieve a near-complete privacy protection in terms of entropy and significantly improve the quality of service utility.

The Novel Location Privacy-Preserving CKD for Mobile Crowdsourcing Systems

With the development of mobile devices, mobile crowdsourcing has become the research hotspot in mobile crowd sensing networks (MCSS). How to protect the location privacy of mobile user in location-based services is a key problem in MCSS. However, with the increase of privacy-preserving level, the service quality will be influenced and decrease. In order to prevent mobile user’s location privacy from being leaked, this paper proposes a location privacy-preserving mechanism CKD through combining ${k}$ -anonymity and differential privacy-preserving. In addition, the tradeoff between privacy protection and service quality is solved based on Stackelberg game. Through comparison experiments, the proposed location privacy-preserving CKD is verified. In addition, the tradeoff between privacy protection and service quality can be solved by our location privacy-preserving.

Privacy Games Along Location Traces

The mainstream approach to protecting the privacy of mobile users in location-based services (LBSs) is to alter (e.g., perturb, hide, and so on) the users’ actual locations in order to reduce exposed sensitive information. In order to be effective, a location-privacy preserving mechanism must consider both the privacy and utility requirements of each user, as well as the user’s overall exposed locations (which contribute to the adversary’s background knowledge). In this article, we propose a methodology that enables the design of optimal user-centric location obfuscation mechanisms respecting each individual user’s service quality requirements, while maximizing the expected error that the optimal adversary incurs in reconstructing the user’s actual trace. A key advantage of a user-centric mechanism is that it does not depend on third-party proxies or anonymizers; thus, it can be directly integrated in the mobile devices that users employ to access LBSs. Our methodology is based on the mutual optimization of user/adversary objectives (maximizing location privacy versus minimizing localization error) formalized as a Stackelberg Bayesian game. This formalization makes our solution robust against any location inference attack, that is, the adversary cannot decrease the user’s privacy by designing a better inference algorithm as long as the obfuscation mechanism is designed according to our privacy games. We develop two linear programs that solve the location privacy game and output the optimal obfuscation strategy and its corresponding optimal inference attack. These linear programs are used to design location privacy--preserving mechanisms that consider the correlation between past, current, and future locations of the user, thus can be tuned to protect different privacy objectives along the user’s location trace. We illustrate the efficacy of the optimal location privacy--preserving mechanisms obtained with our approach against real location traces, showing their performance in protecting users’ different location privacy objectives.